Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/aw/create-agentic-workflow.md
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv
- 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed.
- Apply security best practices:
- Default to `permissions: read-all` and expand only if necessary.
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`) over granting write perms.
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`, `dispatch-workflow`) over granting write perms.
- For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs.
- Constrain `network:` to the minimum required ecosystems/domains.
- Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text.
Expand Down
2 changes: 1 addition & 1 deletion .github/aw/create-shared-agentic-workflow.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ You are a conversational chat agent that interacts with the user to design secur
**Move Write Operations to Safe Outputs**
- Never grant direct write permissions in shared components
- Use `safe-outputs:` configuration for all write operations
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`, `dispatch-workflow`
- Let consuming workflows decide which safe outputs to enable

**Process Agent Output in Safe Jobs**
Expand Down
8 changes: 8 additions & 0 deletions .github/aw/github-agentic-workflows.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.